Cybersecurity researchers have uncovered a new software supply chain attack named SleeperGem that targets the Ruby ecosystem through malicious RubyGems packages designed to compromise developer machines. According to researchers, three RubyGems packages were published or updated with malicious code that acts as a loader for additional payloads. The affected packages include git_credential_manager versions 2.8.0 through 2.8.3, published on July 18, 2026, Dendreo versions 1.1.3 and 1.1.4, and fastlane plugin run_tests_firebase_testlab version 0.3.2. The campaign has been analyzed by StepSecurity, which stated that each malicious release downloads a second stage payload from an attacker controlled Forgejo host, checks whether it is running inside a build environment, and if it detects a developer machine instead, installs a native daemon along with persistence mechanisms.
Researchers noted several characteristics that distinguish the SleeperGem campaign from typical software supply chain attacks. The package named git_credential_manager was created to impersonate Microsoft’s official Git Credential Manager, while Dendreo and fastlane plugin run_tests_firebase_testlab remained inactive for several years before receiving malicious updates. Dendreo had not been updated since October 2020, while the fastlane plugin had remained unchanged since March 2019 before the compromised versions appeared. Another unusual aspect was that the malicious releases were uploaded directly to RubyGems without any matching commits or source code tags in their associated repositories. The attackers also linked git_credential_manager as a dependency for five packages, including Dendreo, fastlane plugin run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, and array_fast_methods, allowing the malicious code to reach existing users of those packages. Researchers believe that multiple RubyGems maintainer accounts may have been compromised because the affected packages belonged to different maintainers.
Once installed, the malware scans nearly 30 environment variables associated with services such as GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any continuous integration environment is detected, the malware immediately exits, indicating that the attackers intentionally designed the campaign to avoid automated build systems and instead focus on developer workstations. When executed on a targeted machine, the malicious code downloads a shell script named deploy.sh together with a native binary from a public Forgejo instance. On Windows systems, the payload is launched through PowerShell. Researchers found that version 2.8.2 primarily downloaded the payloads, while version 2.8.3 expanded the attack by launching the binary as a background daemon, creating persistence through cron jobs and systemd user services, and checking user privileges. If passwordless sudo access is available, the malware attempts to elevate privileges and creates a setuid root shell disguised as a networking utility. StepSecurity has advised anyone who installed the affected packages to consider their systems and associated credentials compromised, remove the malicious daemon from the local system, delete persistence mechanisms, inspect for unauthorized setuid files, and rotate all exposed credentials.
Researchers believe the campaign demonstrates how dormant open source package accounts can become attractive targets for attackers. Aikido Security researcher Charlie Eriksen explained that inactive RubyGems accounts that appear harmless after years of inactivity can be hijacked without drawing attention, giving rise to the name SleeperGem. The disclosure follows several recent incidents affecting the Ruby ecosystem. More than two months ago, RubyGems temporarily suspended new account registrations after attackers published dozens of malicious packages during a coordinated spam campaign. Around the same period, Socket researchers identified another operation involving approximately 150 RubyGems packages used as a data exfiltration channel. Earlier this month, Mend.io disclosed a separate software supply chain campaign involving 14 RubyGems packages that stored stolen credentials. That attack involved a malicious browser extension that collected sensitive information through a locally accessible API, packaged the stolen data into valid RubyGem files using JavaScript and standard web APIs, and uploaded them directly to RubyGems.org using a hard coded API key. According to researchers, the stolen information included plaintext passwords, SSH private keys, AWS credentials, cryptocurrency wallet seed phrases, Social Security numbers, credit card details, and bank account information across 63 vault items, demonstrating how trusted software repositories can also be misused as storage locations for exfiltrated data.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
